Vulnerability in Red Hat Multicluster Engine For Kubernetes
CVE-2025-2241
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com
Frequently asked questions
- What is CVE-2025-2241?
- CVE-2025-2241 is a high-severity vulnerability in Red Hat Multicluster Engine For Kubernetes, classified under CWE-922. CVSS score: 8.2/10. Published 2025-03-17.
- How severe is CVE-2025-2241?
- High severity. CVSS v3 base score is 8.2 out of 10.